Socket Threat Research identified 77 Firefox extension identities linked to the “Offside Wallet Theft Factory,” with 40 confirmed malicious extensions that steal wallet secrets or credentials and 37 deceptive sports-score shells that appear to support the same publishing pipeline. The campaign impersonates OKX, Rabby Wallet, TronLink, and other Web3 products using Supabase-controlled loaders, Cloudflare Workers, hardcoded C2 infrastructure, and version repurposing across Firefox IDs. #Firefox #Supabase #CloudflareWorkers #RabbyWallet #OKX #TronLink
Keypoints
- Socket tracked 77 Firefox extension identities tied to a broader campaign it calls “Offside Wallet Theft Factory.”
- Forty extensions were confirmed malicious, while 37 additional extensions were deceptive sports-score shells linked by shared code, infrastructure, and publishing artifacts.
- The campaign has operated since at least March 2026 and continued into August, with 18 additional identities found during the investigation.
- Some extensions impersonated OKX, Rabby Wallet, and TronLink, using remote-controlled Supabase projects to switch between benign and phishing content.
- Other variants exfiltrated recovery phrases, private keys, serialized keyrings, credentials, and clipboard data through Cloudflare Workers or hardcoded C2 servers.
- Historical version histories show several Firefox IDs were repurposed from sports-score shells or utility builds into wallet-stealing extensions.
- Mozilla was notified about live extensions, and the report warns that exposed recovery phrases or private keys should be treated as permanently compromised.
MITRE Techniques
- [T1176.001] Software Extensions: Browser Extensions – The campaign is delivered through Firefox add-ons that perform phishing, wallet theft, or credential collection (‘Firefox extension identities linked through code reuse’ / ‘malicious Firefox extensions’).
- [T1204] User Execution – Victims must install and interact with the extension or submit secrets into its interface for compromise (‘When a victim opens the extension’ / ‘requests a recovery phrase or private key’).
- [T1059.007] Command and Scripting Interpreter: JavaScript – Malicious logic is implemented in extension JavaScript files such as background scripts and popup code (‘byte-identical copies of background.js, popup.js, popup.html’).
- [T1036.005] Masquerading: Match Legitimate Resource Name or Location – Extensions impersonate legitimate products and use lookalike names, branding, or homoglyphs (‘impersonate OKX, Rabby Wallet, TronLink’ / ‘The name substitutes a zero for the letter “O” in OKX’).
- [T1056.002] Input Capture: GUI Input Capture – Fake wallet forms capture recovery phrases and private keys entered by users (‘requests a recovery phrase or private key’ / ‘The import workflow requests a recovery phrase or private key’).
- [T1005] Data from Local System – Modified Rabby builds access locally stored keyring data before it is encrypted (‘capture serialized keyring data’ / ‘before the legitimate encryption and storage logic runs’).
- [T1115] Clipboard Data – Some extensions collect clipboard contents and exfiltrate them in chunks (‘collect credentials and clipboard contents’ / ‘transmit them through /html/continue.php’).
- [T1102.001] Web Service: Dead Drop Resolver – Supabase is abused as a remote controller to deliver phishing URLs (‘queries the public_notes table’ / ‘By changing a single Supabase value’).
- [T1071.001] Application Layer Protocols: Web Protocols – Exfiltration and control traffic use HTTP(S) web requests to Workers, pages.dev, and API endpoints (‘send stolen recovery phrases’ / ‘POST hxxp://77[.]91[.]100[.]175/html/app[.]php’).
- [T1020] Automated Exfiltration – Stolen secrets are automatically transmitted to attacker infrastructure as soon as they are captured (‘sends them to a hardcoded C2 server’ / ‘transmit it over plain HTTP’).
- [T1030] Data Transfer Size Limits – Clipboard data is split into numbered chunks for transfer (‘divides the captured content into numbered chunks’).
- [T1041] Exfiltration Over C2 Channel – Wallet secrets, credentials, and keyrings are sent directly to attacker-controlled infrastructure (‘exfiltrate them through Cloudflare Workers’ / ‘hardcoded HTTP endpoint’).
Indicators of Compromise
- [Firefox extension IDs ] confirmed malicious and deceptive extensions – [email protected], [email protected], [email protected], [email protected]
- [SHA-256 hashes ] malicious package fingerprints – 08b7b064fa9a41b06774315d944ffddff705ab727222a0c3bcac64a77553bf2fb, 4d0912d575087dab5f468214a2fd259bc386472a8b2b93b6e2441cde4bd941cb and 2 more hashes
- [Supabase project URLs ] remote-control infrastructure for phishing loaders – hxxps://vnigkfdwwyphfafficet[.]supabase[.]co, hxxps://vgksucdjccsojzuhckzk[.]supabase[.]co, and other 6 items
- [Phishing URL ] wallet-phishing landing page loaded by the 0KX WEB3 loader – hxxps://portal-web3-extension-welcome[.]pages[.]dev/home
- [Cloudflare Workers endpoints ] wallet-secret exfiltration infrastructure – hxxps://dry-bush-5408[.]animalrescueeducationcenter-org[.]workers[.]dev/, hxxps://winter-smoke-a612[.]icy-star-f45c[.]workers[.]dev/, and other 2 items
- [HTTP C2 server ] credential and clipboard collection backend – 77[.]91[.]100[.]175
- [Credential collection URLs ] exfiltration endpoints for stolen logins – hxxp://77[.]91[.]100[.]175/html/app[.]php, hxxp://77[.]91[.]100[.]175/html/continue[.]php
- [Keyring exfiltration endpoints ] Rabby-derived theft infrastructure – hxxp://id[.]gemachriverdale[.]org:9000/hook/ptvve, hxxp://alt[.]e-wl[.]com:9000/hook/alt, and other N items
- [Request markers and campaign tokens ] shared identifiers in exfiltration traffic – EQOx7EIPZSNi, action=login&ss=EQOx7EIPZSNi&key=login&w1=
- [API-Sports endpoints ] deceptive sports-score shell functionality – https://v3.football.api-sports.io/fixtures?live=all, v2.nba.api-sports.io and other sports-data endpoints
- [Hardcoded file/script names ] shared implementation artifacts – quickVaultNote, public_notes, collectMetrics, apropriate
Read more: https://socket.dev/blog/firefox-crypto-wallet-theft